Threat Intelligence Database

A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.

CVE-2026-76151 is an out-of-bounds read vulnerability in the HTTP Cache-Control response header parsing within the QtNetwork module of Qt versions 6.0.0 through 6.8.8 and 6.9.0 through 6.11.1. This flaw allows remote attackers to cause a denial of service (application crash) by sending an excessively large Cache-Control header value from an untrusted or compromised HTTP server to a client application using QNetworkAccessManager. The issue affects only the client side, does not impact 32-bit builds, and involves read-only out-of-bounds access without information disclosure or code execution.

CVE-2026-13326 is an out-of-bounds read vulnerability in Qt NFC's language code length parsing. This flaw allows a physically proximate attacker to cause a denial of service or limited memory disclosure by using a specially crafted NFC tag. The vulnerability affects Qt versions from 5.2.0 up to but not including 6.8.9, and from 6.9.0 up to but not including 6.11.2. It has a CVSS 4.0 score of 6.9, indicating a critical severity level. No explicit patch links are provided in the data, and no known exploits are reported in the wild.

Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that violates the RFB protocol can bypass Qt VNC Server's password authentication and gain unauthorized remote access to the shared application, compromising the confidentiality and integrity of the session.

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.

Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.

QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero). This is fixed in 5.15.19, 6.5.9, and 6.8.2.

LowVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-23050#cwe-125

There is an incomplete cleanup vulnerability in Qt Network's Schannel support on Windows which can lead to a Denial of Service over a long period. This issue affects Qt from 5.15.0 through 6.8.3, from 6.9.0 before 6.9.2.

When passing values outside of the expected range to QColorTransferGenericFunction it can cause a denial of service, for example, this can happen when passing a specifically crafted ICC profile to QColorSpace::fromICCProfile. This issue affects Qt from 6.6.0 through 6.8.3, from 6.9.0 through 6.9.1. This is fixed in 6.8.4 and 6.9.2.